Update

Author: Domenico Panella

mklive.sh.in

@@ -32,6 +32,7 @@ umask 022
 readonly REQUIRED_PKGS="base-files libgcc dash coreutils sed tar gawk syslinux grub-i386-efi grub-x86_64-efi squashfs-tools xorriso"
 readonly INITRAMFS_PKGS="binutils xz device-mapper dhclient dracut-network openresolv"
 readonly PROGNAME=$(basename "$0")
+toSign=0
 
 info_msg() {
     printf "\033[1m$@\n\033[m"
@@ -199,6 +200,11 @@ generate_isolinux_boot() {
         "$ISOLINUX_DIR"/isolinux.cfg
 }
 
+dosign() {
+    print_step "Signing $2..."
+    sbsign --key $DBKEY --cert $DBCRT --output "$1".signed "$1"
+}
+
 generate_grub_efi_boot() {
     cp -f grub/grub.cfg "$GRUB_DIR"
     cp -f grub/grub_void.cfg.in "$GRUB_DIR"/grub_void.cfg
@@ -237,9 +243,8 @@ generate_grub_efi_boot() {
     cp -f "$VOIDHOSTDIR"/tmp/bootia32.efi "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTIA32.EFI
 
     #Bootloader signing
-    if  ([ $toSign ] &&  [ -f "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX32.EFI ]);then
-        print_step "Signing BOOTX32.EFI..."
-        sbsign --key $DBKEY --cert $DBCRT --output "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX32-signed.EFI "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX32.EFI
+    if [ $toSign -eq 1 ] && [ -f "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX32.EFI ]; then
+        dosign "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX32.EFI BOOTX32.EFI
     fi
 
     xbps-uchroot "$VOIDHOSTDIR" grub-mkstandalone -- \
@@ -255,9 +260,8 @@ generate_grub_efi_boot() {
     cp -f "$VOIDHOSTDIR"/tmp/bootx64.efi "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX64.EFI
 
     #Bootloader signing
-    if  ([ $toSign ] &&  [ -f "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX64.EFI ]);then
-        print_step "Signing BOOTX64.EFI..."
-        sbsign --key $DBKEY --cert $DBCRT --output "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX64-signed.EFI "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX64.EFI
+    if [ $toSign -eq 1 ] && [ -f "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX64.EFI ]; then
+        dosign "${GRUB_EFI_TMPDIR}"/EFI/BOOT/BOOTX64.EFI BOOTX64.EFI
     fi
 
     umount "$GRUB_EFI_TMPDIR"
@@ -357,17 +361,17 @@ fi
 
 #The -d and -t options are complementary. If one exists, the other must also exist. 
 #If these options are set, I also check sbsign command.
-if  ([ -z $DBKEY ] &&  [ ! -z $DBCRT ]) || ([ ! -z $DBKEY ] &&  [ -z $DBCRT ]); then
+if  ([ $DBKEY ] &&  [ ! $DBCRT ]) || ([ ! $DBKEY ] && [ $DBCRT ]); then
     die "Must be set a key and certificate via -d and -t option, exiting..."
-elif ([ $DBKEY ] && [ $DBCRT ]); then
-    if [ $DBKEY ] && [ ! -f $DBKEY ]; then
+elif [ $DBKEY ] && [ $DBCRT ]; then
+    if [ ! -f $DBKEY ]; then
         die "$DBKEY does not exist, exiting..."
-    elif [ $DBCRT ] && [ ! -f $DBCRT ]; then
+    elif [ ! -f $DBCRT ]; then
         die "$DBCRT does not exist, exiting..."
-    elif ! [ -x "$(command -v sbsign)" ]; then
+    elif ! command -v sbsign > /dev/null; then
         die "sbsign command does not exist, exiting..."
     else
-        toSign=true
+        toSign=1
     fi
 fi